What the job looks like day to day
Titles include AI governance lead, responsible AI manager, AI risk analyst, AI policy counsel and AI ethics specialist. The work usually covers:
- Keeping an inventory of every AI system in use, who owns it and what data it touches.
- Running risk assessments before launch and when a system changes, using a framework such as the NIST AI RMF.
- Reviewing vendors: data retention, training on customer data, security and contract terms.
- Writing policy: acceptable use, human review rules and disclosure to customers.
- Training staff. In the EU, the AI Act's AI literacy duty has applied since 2 February 2025.
- Handling incidents when a system produces harmful, biased or wrong output, and recording what changed.
- Tracking regulation across jurisdictions and translating it into concrete controls.
Technical governance roles also design or commission evaluations, such as testing a classifier for unequal error rates across groups. Our guide to AI detector false positives shows why error types must be reported separately.
Skills table
| Skill | Why it matters | How to show it |
|---|---|---|
| Framework fluency | Buyers and regulators expect a recognized structure | A risk register mapped to NIST govern, map, measure and manage |
| Regulatory reading | Obligations depend on role, risk tier and dates | A one-page summary of which AI Act duties apply to one product |
| Risk assessment | Leaders need ranked risks, not lists | An assessment that rates likelihood and impact with evidence |
| Evaluation literacy | Claims about fairness or accuracy need tests behind them | A review of one published model card, noting missing tests |
| Vendor due diligence | Most AI risk enters through bought tools | A completed vendor questionnaire for a real AI product |
| Policy writing | Staff follow short, specific rules | A one-page acceptable use policy |
| Communication | Engineers, lawyers and executives need different detail | A board-level summary under 300 words |
Learning path with free official resources
- NIST AI Risk Management Framework. The NIST AI RMF, released 26 January 2023 for voluntary use, is the standard US reference structure. Its core has four functions: govern, map, measure and manage.
- NIST Generative AI Profile. NIST AI 600-1, released 26 July 2024, defines 12 risks that are novel to or made worse by generative AI, from confabulation to value chain and component integration, with suggested actions for each.
- The EU AI Act. The European Commission's AI Act page gives the timeline: in force 1 August 2024; prohibited practices and AI literacy from 2 February 2025; general-purpose model obligations from 2 August 2025; broadly applicable from 2 August 2026, with longer transitions for some high-risk systems. Read Article 4 on AI literacy as a first article.
- OECD AI Principles. The OECD AI Principles were adopted in May 2019 and updated in May 2024; they guide AI developers and give policymakers recommendations for AI policy.
- A credential, if you want one. The IAPP's AIGP certification publishes a free Body of Knowledge and exam blueprint; the exam itself is paid.
- Evaluation basics. Our AI evaluation learning path covers test sets, rubrics and agreement checks, which governance reviews depend on.
- Operational practice. Our team rollout guide and AI tool privacy checklist show how policy turns into day-to-day rules.
NIST's Generative AI Profile, AI 600-1, released 26 July 2024, names 12 risks that are novel to or exacerbated by generative AI, including confabulation and data privacy.
Pay: which BLS occupation applies
The US Bureau of Labor Statistics does not track AI ethics or AI governance as an occupation, so use the occupation that matches the work.
- Management analysts. Governance analysts who assess processes and recommend controls fit here. The BLS management analysts page gives a median annual wage of $101,860 in May 2025 and projects 10% employment growth from 2025 to 2035.
- Computer and information systems managers. Heads of AI governance who direct technology programs fit here, with a $175,140 median in May 2025 per the BLS page for computer and information systems managers.
BLS reports a $101,860 median annual wage for management analysts in May 2025, the closest analyst occupation to AI governance work.
Legal, privacy and security specialists also move into AI governance and bring their own occupation's pay range. These are national medians for broad occupations, not AI governance offers.
Portfolio ideas
- A risk register for a public AI product, mapped to the four NIST functions, with three top risks and controls.
- An AI Act applicability memo for a fictional company deploying a hiring screener, naming the risk category and the duties that follow.
- A vendor review of one AI writing or meeting tool using its published terms on data retention and training.
- A one-page acceptable use policy with allowed, restricted and banned data types.
- A bias evaluation summary that reports error rates by group for a public dataset, with limits stated.
- An incident write-up of a public AI failure: what happened, which control would have caught it, and what to change.
Pair this guide with the AI workflow design path for the operational side, or browse the careers hub for other roles.
How to get your first role
Most AI governance professionals arrive from privacy, legal, compliance, risk, security or data science. A practical route:
- Own the AI inventory at your current employer; it is often the first governance task nobody has done.
- Run one risk assessment on a real AI tool your company uses, mapped to the NIST functions.
- Draft the acceptable use policy and the staff training, then measure how many people completed it.
Employers value people who can turn a regulation into a checklist an engineer will actually follow. A short, specific policy that people use beats a long one nobody reads.
How we researched this
We read the NIST AI RMF page and core, NIST AI 600-1, the European Commission's AI Act page, Articles 4 and 53 of the AI Act, the OECD AI Principles page, the IAPP AIGP page and the BLS pages for management analysts and computer and information systems managers on 17 October 2026. Pay figures are national medians for related occupations.
Frequently asked questions
What does an AI governance professional do? They keep an inventory of AI systems, assess risks, review vendors, write policy, train staff and handle incidents. The goal is legal, accountable use of AI.
How much do AI governance jobs pay? BLS does not publish the title. Management analysts had a $101,860 median annual wage and computer and information systems managers $175,140 in May 2025.
Do I need a law degree for AI governance? No, though legal and privacy backgrounds are common. Risk, compliance, security and data science backgrounds also lead into the field.
Is the NIST AI RMF mandatory? No, NIST describes it as intended for voluntary use. Many organizations and buyers still use it as their common structure.
When does the EU AI Act apply? It entered into force on 1 August 2024 and became broadly applicable on 2 August 2026, with AI literacy and prohibitions from 2 February 2025, per the European Commission.
Is the IAPP AIGP certification worth it? It is a recognized credential, and its Body of Knowledge is free to read. Portfolio work showing real assessments matters at least as much.
What is the difference between AI ethics and AI governance? Ethics asks what an organization should do with AI; governance builds the policies, reviews and records that make sure it happens.